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AEROSPACE SAFETY ADVISORY PANEL np pnr 
ANNUAL REPORT 
ERRATA AND UPDATE SHEET 


Corrigenda and/or Update 

Last paragraph, 3rd line from top: Change 
"test-proven” to "test derived . " 

First paragraph, 3rd line from top: "safety" 
should be " safely . " 

Second paragraph, 2nd line from the bottom: 

"STS-5" should be "STS." 

Second paragraph, 5th line from top: remove 
the word " tire " so that it reads "...severe 
loads induced ..." 

Second paragraph, 2nd line from top: "emergences" 
should be " emergencies . " 

Item 5 at bottom of page: Should read " Experiences 

in flying large delta-wing or swing -wing type axr- 
craft as well as the SR-71, B-1 and others." 


First paragraph, 4th line from top: "exacerbatd" should 
be "exacerbated . " 

First paragraph, 4th line from top: "B-757" should 

be "B-747. " 

First paragraph, 3rd line from top: "not" should 

be "no . " 

Last paragraph, 9 lines from bottom: "Clearly will 
not save" should be "It is probably unlikely to save..." 

Second paragraph, 5th line from top: "Faciliteis" should 
be "facilities. " 

Second paragraph, 7th line from top: "every" should be 
"ever . " 


Last paragraph, 8th line from bottom: "an" should be "and. " 

Item 2: "Reveiw" should be "RevievT. " 

Item 4: "Knopt" should be "Knopf. " 
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INTRODUCTION AND SUMMARY 


The ties of the Aetospace Safety Advsiory Panel (ASAP) 

accelerated in 1982 to support the increased flight rate of the 
Space Tr ahspor tat ion System (STS) and the assessment of data 
being acquired on the actual flight experience with the various 
subsystems. Approximately forty meetings took place involving 
NASA personnel, NASA contractors and members of the ASAP. The 
meetings included visits to all NASA centers directly involved iri 
the flight hardware and its launching and testing, as well as 
contractor facilities. Appendix I contains a list of visits for 
1982 along with subjects covered during both the individual 
visits and the complete Panel discussions. 


During the year the Panel membership was augmented by the 
appointment of Gerald W. Elverum, Jr., Vice President and General 
Manager of the Applied Technology Division of the TRW Space and 
Technology Group. The purpose of this appointment was to augment 
the Panel’s knowledge of propulsion systems needed because of Dr. 
Seymour C. Himmel's completion of his six-year term and the 
signal importance of these systems to Shuttle and payload safety. 
Because of Dr. Himmel’s familiarity with the entire Shuttle 
development, he has been retained as a consultant. 


In addition to Gerald Elverum' s appointment, the Panel has 
added Robert D. Rothi, Chief Design Engineer of the Douglas 
Aircraft Company as a consultant to follow the progress of 
essential STS systems, landing gear, flight controls, pov^er and 
other auxiliary systems as flight experience is obtained. It is 
the plan to appoint Robert Rothi to the ASAP as a member when a 
position becomes available in the statutory number of members due 
to normal completion of terms. The total membership of the Panel 
is listed in Appendix II. 
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This year's Panel report will be based upon newly analyzed 
information from flights STS-1 , and STS-2 in 1981 r and the mote 
current information from STS~3, -4/ and -5. In addition, we have 
reviewed the status of R&D aircraft and administrative aircraft 
flight safety procedures and administration for support, test, 
and training flights utilizing NASA's fleet of aircraft based at 
the several centers. 

The Panel continued with its study of NASA's plans and 
improvements to increase the flight rate of the Shuttle, improve 
the logistics and reduce the turn-around costs. 

NASA staff activities supporting the needs of the ASAP, the 
gathering of data, the scheduling of fact-finding tor the members 
and the alert reporting of changes, test results, organization 
changes, and NASA schedules have been exceptionally well handled 
during 1982, and the Panel appreciates this excellent support. 

As a result of its work the Panel has the following 
conclusions and recommendations to make; 

CONCLUSION 1 


The Shuttle has been successful as a developmental vehicle 
but the flight test series has been too short to completely 
explore the design performance envelope. 

RECOMMENDATION 1 

A formal program should be implemented to identity flight 
test objectives compatible with each Shuttle mission flown so 
that the entire flight envelope will be defined in a timely 


manner , 
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CONCLUSION 2 

The determination of the performance envelope of the Shuttle 
includes a determination of the loads that the vehicle 
experiences in flight. Before this determination is complete, 
there have been parallel efforts to reduce actual factors of 
safety in order to reduce weight. This reduction must proceed 
cautiously until the structural loads and capability are 
confirmed. 

RECOMMENDATI ON 2 

The Panel recommends that extreme caution be used in 
decreasing structural factors of safety for weight purposes 
before all the pertinent flight variations are explored and all 
relevant data has been analyzed and taken into account. A 
corollary recommendation is that the Modular Auxiliary Data 
System (MADS) instrumentation package be carried until the flight 
limits are determined. 

CONCLU SION 3 

The Shuttle and its operation is not an airline, even though 
the airline approach to solving problems such as logistics may 
well apply. The literal application of the detailed solution of 
airline problems can be misleading when applied to Shuttle 
situations. Nevertheless, Shuttle "operations" will be 
sufficiently different from R&D flying to justify a major 
operational organization which conc^entrates on the reduction of 
turn-around time, cost, and operational safety. The R&P 
community should respond to the operators of the STS on a demand 
(contract) basis. 
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RECOMMENDATION 3 

The NASA should identify a single, responsible operational 
logistics organization, properly staffed, that should determine 
what commercial methodology is useful to the Shuttle and then 
determine the extent to which those methods are applied to 
Shuttle problems. 

CONCLUSION 4 


Shuttle operation will require a major sustaining engineering 
effort by the present NASA centers and contractors, particularly 
until the operational capability is defined and implemented. 

This should not be confused with, or fur'ded as R&D. 

RECOMMENDATION 4 


In order to control operational economics, the Panel 
recommends that the sustaining engineering should be the 
responsibility of, and be budgeted by, the operational 
organization, regardless of where and who does the work. 

CONCLUSION 5 


The pressure of schedules seems to have relaxed the rigor of 
the certification process as applied to changes. 

RECOMMENDATION 5 


In the past, the certification of the Shuttle involved many 
test considerations and revie*-*?;. The current and future changes 
in the Shuttle must have the same rigor of certification. The 
policy and standards should be established by an independent 
organization within NASA, e.g, the Chief Engineer, and should 
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have the direct sponsorship of the Administrator. FAA processes 
and practices may provide a model. Such a program if it is a 
function of the NASA chief engineer, would also be independent of 
any future operations organization and, thus, it would be in a 
position to certify operational procedure and practices. Such a 
procedure would also simplify the Panel's problem of being 
informed of changes in a timely manner. 

CONCLUSI ON 6 

The aerodynamic flight stability of the Shuttle is 
exceedingly important in the landing phases. To the extent that 
this maneuver is a combination of the ship's very critical 
stability characteristics, the pilot's perception of control 
needs, and the computer's logic, it is a deceptively simple thing 
with little room for error. The apparent panacea of switching to 
the present autoland system should be cautiously explored. It is 
also important to give the pilot every tool available to enhance 
his perception of the craft's performance. The heads-up display 
is in this category and is useful both in the manual as well as 
in monitoring autoland performance. 

RECOMMENDATION 6 


The Panel recommends that autoland be tried at the earliest 
opportunity where there is a "repeat" pilot who has previously 
made a m.anual Shuttle landing. This dual experience will be 
invaluable in assessing manual vs. automatic operation. It is 
also recommended that the total installation of the heads-up 
display be expedited and be operational for this demonstration. 

CONC LUSION 7 

Substantial redesign of the SSME turbomachinery is required 
for the desired engine life at the outputs needed by proposed 
future payloads. 
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RECOMMENDATION 7 

The Panel recommends the design of new teplacement 
turbomachinery for the SSME that will achieve current required 
mission life at the full power level. If possible without 
compromising the achievement of these objectives provisions might 
be incorporated for future growth. In addition to the 
procurement of adequate numbers of the current turbomachinery 
elements, the interim, need for spares created by the short life 
of the current machines at high output must be met. 

CONCLUSION 8 



The Panel feels that the landing gear tires and brakes have 
proven to be marginal and constitute a possible hazard to the 
Shuttle. 

RECOMMENDATION 8 


A study of a gear redesign should be started that will 
achieve an adequate factor of safety with the maximum proposed 
Shuttle loads. It seems to the Panel that such an effort should 
include an investigation of changing the attitude of the Orbiter 
on its gear. Reducing the nose-down attitude would substantially 
reduce wheel loads during rollout and braking. 


1/ It 
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FLIGHT SYSTEMS EXPERIENCE THRO U GH 1982 

The ASAP, in f:ollv'>wing the results of; current tlight data 
commend both the development tea«i!> at the centers and the 
operational teams which launched, conducted the mission and 
retrieved the Orbiter and its crews. The ASAP particularly 
tracked the pertormance ot the internal power systems, control 
systems, and the thermal protection systems, all ot which had 
concerned the Panel in the initial development phases of the 
program. It is encouraging to report that all ot these systems 
appear to be per terming well. 

The Panel has continuing concern regarding the progress in 
tlight control development, the confirmation ot structural 
integrity, the achievements ot operational ratings ot the main 
engines, and the transition ot the entire system to operational 
status in the absence of complete flight confirmation of the 
Shuttle element pertormance. These specific areas of 
concentration tor the ASAP ate in the following sections. 

FLIGHT CONTROL PERFORMANCE 

The Demonstration of Autoland Systems 

The Aerospace Safety Advisory Panel recommends that 
NASA Headquarters assure the completion ot the remaining 
simulations and tests of the Orbiter Autolfnd system, including 
touchdown and rollouts, and, it successful, encourage the 
earliest use thereof. 

We believe that safety will be enhanced it the approach and 
landing conditions ot airspeed, angle ot attack, sink speed, and 
touchdown point can be optimized by automatic control. The 
experience that suggest this emphasis includes: 


• 


Studies ot Shuttle landings to date show that tire, 
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wheel, and brake stresses are approaching limits. 

b. Short runways, with inadequate overruns, are a cause for 
concern, for instance, a transAtlantic abort to Dakar, 

c. Landing with excess speed increases stresses, as well as 
exposing the Orbiter to a "weight on wheels" instability that is 
divergent, as in most delta-wing aircraft. 

Problems in pitch control of the Orbiter have been observed 
since the Pilot Induced Oscillations (PIO) of the fifth Approach 
and Landing Test (ALT 5) . Some improvements can be made in 
software and mechanical controls, but correction of the basic 
characteristics would require complete redesign; perhaps 
including canard control s'-Tfaces. 

A skilled pilot, under non-stressf ul conditions, can "grease" 
the Orbiter onto the runway; witness some of the beautiful 
landings to date. This requires great precision in establishing 
approach conditions, and the avoidance of any sudden inputs to 
pitch control. Aborts, heavy payload landings, less skilled 
pilots - all bias conditions toward the limits in control and 
mechanical capability. 

An autoland landing takes the uncertain "gain" of the pilot 
out of the loop. The precision and resolution of the Inertial 
Measuring Units and the integrating rate gyros combined with 
Microwave Scanning Beam Landing System (MSBLS) and the digital 
autopilot allows the main computers to control attitude, 
airspeed, and sink rate to a precision that few humans can match 
except under ideal conditions. 

. f 

As to reliability: 

a. Automatic landings have been in use in commercial 
aircraft operations for about 10 years. 
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b. Elements of the autoland system have been used on every 
Shuttle flight excluding final glide slopes and landing. 


c. Dozens of Shuttle training aircraft flights have used the 
MSBLS at KSC (down to about 20 feet above the runway) . 


In attempting to promote demonstration of the autoland 
system, the ASAP recognizes these factors as valid: 

a. Astronauts, by virtue of years of training and simulation 
experience in the manual control process, ace understandably 
reluctant to "let a machine do it.” 


b. Monitoring progress of the autoland system is difficult 
without a heads-up display or other device to assist in judging 
progress and eases take-over in the event of system failure, 

V 

Nevertheless, the ASAP urges such a demonstration and 
suggests the following: 

1. A demonstration of the autoland system should be 
scheduled for a repeat commander or pilot as soon as the heads-up 
display is useable. 

2. NASA should reexamine the auto braking and autolanding 
gear extension systems to make the autolanding system complete. 

3. Provisions for autoland should be installed at the most 
likely contingency landing sites, e.g. Dakar. 

4. The investigations of ground control de-orbit should be 
revisited for possible rescue via automatic de-orbit and remote 
or automatic control to autoland. 
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STRUCTURAL INTEGR r.TY 

During the year 1982, the ASAP has given particular attention 
to the safety aspect of the following structural areas: 

o Lightweight external tank 
o Use of instrumented flight data 

o Continued expansion of structural operating limits 
o Structural modification of OV-102 

o Filament wound motor cases for solid rocket boosters 
Filament Wound Case for Solid Rocket Boosters 


The ASAP reviewed the structural aspects of the Filament 
Wound Case (FWC) at MSPC on June 10. The Panel's impression 
based on this limited review is that the plans for design, 
development, and testing are well thought out and that the 
stru';t>,t;al integrity of the final product will be solidly based 
on test data. The minimum flight design factor of safety (F.S.) 
is 1.4. At the pinned joints between composite and steel, a 
F.S, “2(0 is used with "A" allowables* based on test data. 

Light Weight External Tank (LWT) 

The specification for the original external tank, now called 
Heavy Weight or Standard Tank (HWT) , stated that the total inert 
weight be not greater than 77,902 pounds. The actual inert 
weight of the production HWT is 75,900 pounds, of which 57,195 
pounds is structure. 

*"A" allowables refers to material properties (e.g., tensile 
and compressive strength) equal to 99% or more of the population 
of measured values with a confidence level of 95%. 
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As a weight reduction measure, the external tank has now been 
redesigned and the new light weight tank has an actual inert 
weight of 66,800 pounds, of which 52,589 pounds is structure; so 
in going from the heavy to the light the structural weight was 
reduced by 4,600 pounds or 8.0 percent. The remainder of the 
10,400 pounds, sometime reported as weight reduction from the 
original specification, took place in such nonstructural items as 
plumbing, thermal protection provisions, and updating the weight 
bookkeeping to account for the fact that the production HWT was 
2,000 pounds underweight. Panel interest was focused on the 
structural integrity of the LWT. 

In its review of the LWT the ASAP has centered its attention 
on the liquid hydrogen (CH 2 ) section for the following reasons 
(further discussion is found in Appendix III) : 

o The structural weight of the LH 2 tank of the LWT was 
reduced by 10.5 percent from that of the HWT. 

o A critical design condition for the external tank is at 
staging of the Solid Rocket Boosters (SRB) . In the 
absence cf the SRB thrust, most of the 1.5M pounds total 
thrust of the Orbiter's three main engines is transmitted 
from the Orbiter to the aft end of the LH 2 tank and passes 
upward through the LH 2 tank to the liquid oxygen (LOX) 
tank, which is the major mass of the stack at that time. 
The thrust loading produces an axial compression and an 
overall bending due to the eccentricity of the thrustload, 
both of which produce compressive stresses in the LH 2 tank 
shell facing the Orbiter. The most probable failure mode 
is an instability, or buckling, of the LH^ tank shell 
which could lead to serious consequences. 

o The buckling strength of the LH^ section of the LWT has 
been verified by test only to limit load (i.e., 109% of 
rated power level of the main engines) so that any margin 
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of safety between actual operating conditions and failing 
conditions is dependent solely on analytical procedures. 

o Analytical procedures for prediction of shell 

instabilities are complex and not well correlated with 
experimental results, particularly for concentrated loads 
imposed on a complex nonuniform stiffened shell such as 
the tank, 

o The analyses that had been done were linear bifurcation 
types (STAGS and BOSOR) . 

The ASAP was concerned about the structural integrity of the 
Light Weight External Tank because: 

o Data on strength justification has been sparse. 

o Reluctance to depend entirely on linear analytical methods 
to predict failing instability of a complex shell-like 
structure subjected to concentrated loads as in the LH^ 
tank when the design factor of safety is as low as 1,265. 

The maximum thrust of the main Orbiter engines to be used 
during STS-6 is 104% of rated power level. This provides a 
test derived F.S. of 1.14 (i.e., 1.19 FS @ RPL/1.04 RPL) for this 
flight. Concern within ASAP over this narrow margin resulted in 
a meeting which is reported in Appendix III among NASA personnel, 
technical members of the Martin-Marietta Corporation, with ASAP 
members at which views concerning the adequacy of analysis were 
expressed by two independent consultants in analytical methods 
for shell structures. The following recommendation resulted from 
this meeting: The ASAP accepts the adequacy of the current 
analysis and tests for the next Shuttle operation, but recommends 
that the nonlinear analysis now planned be performed to add 
further confirmation of the structrual adequacy of the Light 
Weight Tank (LWT) before flights using 109% of rated power level 
are approved. We understand this work is now underway. 
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Use o£ Inst rument ed Flight Data 

The first five Shuttle flights have produced a substanital 
amount of instrumented flight measurements that are of extreme 
importance to safely, exploiting the full structural capability of 
the STS. To realize the latent benefits of these flight data, it 
needs to be reduced to a readily useable form and then analyzed 
by stress analysts familiar with the structural arrangement, the 
design loading conditions, the analytical and experimental 
internal load determinations, and the failing stress allowables. 

Contin u ed Expansion of Structual Operating Limits 

The instrumented flight data already collected during t)ie 
missions of STS-1 through STS-5, properly analyzed, will provide 
a valuable data base to aid in predicting the safe magnitude of 
steps that can be taken in exploring beyond the boundaries 
established by the first five flights. The Development Flight 
Instrumentation (DFI) package used on the first five flights had 
the capacity to measure and record information from 4,000 
sensors (strain gauges, thermocouples, pressure transducers, 
etc.) . Because the DFI occupied a good portion of the payload 
bay and weighed about 11,000 pounds, it had to be removed from 
OV-102 after STS-5 to make room and payload available for 
Spacelab 1. There are no plans to use the DFI package on any 
future STS missions. To safely explore and establish the 
structural limits needed to utilize the full capability of the 
STS- , some flight instrumentation to monitor critical strength 
items will be required. 

Some of the issues involved in expanding the structural 
limits are: 


OF POOR 

o Ascent and entry loads 
o Payload/Orbiter dynamic interaction 
o Ascent aerodynamic loads distribution 
o Structural thermal stresses versus cross range 
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It appears that the vehicle best suited to carry the brunt of 
the structural limits expansion is OV-102 after it has been 
through the Maxi-Mod process and has been equipped with a Modular 
Auxiliary Data System (MADS) .V Thus modified and equipped, 
OV-102 will have full strength and adequate instrumentation to 
safely expand the structural operating envelope*. 


OV-102, as it flew the STS-1 through STS-5 missions, had 
unexpected structural limitations brought about by weight growth 
and early loads later found in need of correction. Discrepancies 
were dispositioned for the operational flight tests (OFT) and 
performance placards were issued on maneuver load factor (2g) and 
landing sink rate (6 fps) . In addition, top sun conditioning was 
required prior to entry to relieve thermal stresses. 


The ASAP understands that present plans are to use OV-102 
to fly the STS-9 mission. The landing gross weight for STS-9 
will be about 222,000 pounds which compares to the maximum 
previous landing weight of 209,483 pounds (STS-4) . Also, the 


VThe MADS planned for OV-10 2 will have the capability to record 
data from 855 sensors, of which about 500 are allocated to 
structures-related measurements. 


'' ' ■ 
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load carried as cargo will be somewhat over 35,0)0 pounds which 
exceeds the previous maximum of 32,279 pounds (STS-5) . 

Therefore, the STS-9 flight will need to be made with more 
restrictive flight limits than STS-1 through STS-5 in order to 
maintain the same margins of safety. In order to maintain the 
margin of safety of 1.4 in an abort-once-around , the maneuvering 
load factor, n , would be restricted to 1 . 4g and the sink rate on 
landing would be restricted to about 4.5 fps. The Panel believes 
that, with special training and special precautions, the tighter 
restrictions required for STS-9 can be safely flown, albeit at 
some higher level of risk than with a full strength vehicle. 

t 

The ASAP recommends that serious consideration be given to 
incorporating the Maxi-Mod modification into OV-102 following the 
STS-9 mission and also installing the planned data system (MADS) , 
so that a full strength vehicle with adequate instrumentation can 
be used to continue the expansion of the operating envelope to 
the safe limits of the fleet vehicle. 

ORBITE R LAND IN G GEAR 

The landing gear including wheels, tires, and brakes, is 
vital for the safe completion of any mission. With the future 
flights going to higher weights and lower margins, possibly even 
negative margins, it is imperative that existing capabilities be 
fully explored, documented and improved where necessary. 

Of particular concern are the following; 

o The inclusion of HUD or Autoland to consistently minimize 
the touchdown speed and distance from the runway threshold and to 
assure the optimum vehicle attitude to preclude PIO's and high 
ground loads. 


o The inclusion of an Autobrake system to relieve the work 
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load on the pilot during a high strain period and to assure a 
uniform maximum brake pressure available to achieve the desired 
stopping distance. 

o The high torque peaking of the carbon lining and the low 
strength of the beryllium stator and rotor keyways. The 
combination of materials should be reviewed as well as the means 
of attaching the brake to the axle. Excessive axle deflections 
under the abnormally severe loads induced by the negative 

angle of attack at high ground speeds dictate some type of 
floating mount to prevent the brakes from carrying ground loads 
in addition to the normal braking loads. 

o The abnormally severe loads imposed on the main tires due 
to the 3.92° negative angle of attack with the nose tire on the 
ground at high speeds. At 240,000 pounds with aft c.g., the 
static load on each main tire is only 54,000 pounds; whereas, at 
165 knots the tire load increases to 140,000 pounds. Not only 
does this require stronger tires, but also higher inflation 
pressures, over 315 psi, to keep the tire defletions and carcass 
temperatures within limits. As tire pressures and ground speeds 
increase, the attainable coefficient of friction between the tire 
and the runway decreases thus increasing the stopping distance. 

A longer nose gear would help reduce the negative angel of attack 
and the main gear loads. Or it might even be possible to replace 
the dual main wheels with four wheel bogies to reduce the load 
per tire. 

o The foreign-object damage to the thermally protected 
Shuttle surface by debris thrown up by the tires was mentioned in 
last year's report. When the landing performance has been 
improved to the point of using the paved runways, this issue will 
be resolved. Being able to use the paved runways available for 
normal landing and for emc*rgency aborts is essential for 
continuing safe operations. 
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LIT HIUM BATTERIES 

The Panel was asked to assess the safety of the use of 
1 ithlut^-bromine complex batteries just prior to the launch of 
STS-5. The batteries in question were small A-A size cells for 
use in hand-held radios; D size cells in the cassette data 
recorders, space suit lights, TV cameras and the survival radio. 
An investigation revealed that the internal cell and battery 
hazards were acceptable and the Panel agreed that no changes 
should be made prior to STS-5, since the batteries were already 
on hand if not on board. 

Lithium batteries have a large advantage in energy storage 
capability over standard batteries but their characteristics in 
many operational modes are not fully understood and accidents may 
occur if operating limits are exceeded and quality assurance is 
not assiduously controlled in their manufacture. Protection is 
provided to control the hazards. However, there are undoubtedly 
certain applications that are not practical with any other 
battery. In those cases, they should be used with suitable 
precautions. It is not so clear why the hazard would be 
acceptable in a flashlight or hand-held radio application. In 
making such a judgment, one should weigh all the factors such as 
energy requirements, safety, convenience of handling, operating 
limitations and disposal. 

A corollary of this particular Panel activity is that a 
mechanism must be developed to bring hazardous items such as this 
to the Panel's attention in a timely manner. 

EVA AND PREBREATHING 


Extra-vehicular activity is a useful adjunct to the 
Shuttle's capability but, as currently planned, it is not without 
important limitations. To be most useful the suit should operate 
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at the environmental conditions sufficiently close to those of 
tho cabin to eliminate the need for prebreathing in order to 
prevent the "bends.** Current prebreathing time and protocol 
limits the emergency capability of EVA. The ASAP recognizes that 
the design of an all-purpose space suit, useful as a work station 
as well as an emergency device, is not simple but believes that 
the present design should be reviewed to make sure that it is 
acceptable. 

It is not clear to the ASAP that there are major requirements 
for EVA except in some -emergencies or the replacement of failed 
elements of expensive satellites. The requirements for emergency 
use appear to the ASAP to preclude systems that require long 
hours at different pressures than the normal cabin pressure and 
extended prebreathing times. It is suggested that an analysis be 
made for different failure scenarios. Different EVA requirements 
will undoubt<s'dly emerge and such requirememts could dictate EVA 
equipment design requirements. 


MAIN ENGINES 


With but one exception, all propulsion systems of the Shuttle 
functioned flawlessly during all the flights this year. The 
performance of each of the systems; the main engines (SSME's), 
the solid rocket boosters (SRB's) and the orbital maneuvering 
system (QMS) engines was within the range predicted. The one 
Incident that marred this otherwise perfect record was the 
failure of the SRB recovery system in the STS-4 flight. This 
failure had no effect on the mission itself although the SRB 
motor cases were lost. The subtle cause of this failure was 
identified and the corrective action implemented for the STS-5 
flight succeeded in overcoming the problem. 

The certification program for the PPL (109%) version of the 
SSME, in contrast, has been beset by test failures and problems 


that have impeded achievement of engine certification. There 
were two serious incidents, both resulting in significant loss of 
hardware. Both of these failures involved developmental hardware 
changes, in one instance installed on a certification engine. 
Failure reviews were conducted, the causes identified and 
corrective actions implejmented . The loss of hardware suffered 
exacerbated an already existing problem of limited engine 
hardware availability. The Panel has noted in the past its 
concern about the meager supply of hardware in the SSME program. 

The problems that were encountered with SSME turbomachinery 
during development and certification of the RPL (100%) version of 
the engine have reappeared in the FPL program. This is most 
probably a consequence of the higher speeds and operating 
temperatures associated with operating at the PPL thrust level. 
These problems include turbine blade cracking and sheet metal 
cracking in the HPFTP and bearing wear and distress and 
subsynchronous-whir 1 in the HPOTP. All of these phenomena are 
life-limiting. As a consequence, during the PPL certification 
program frequent replacements of the turbopumps have been 
required. As of the end of October 1982, no FPL high-pressure 
turbopump had been able to accumulate more than 2500 seconds of 
operation without removal for cause. 

There exists a program of design changes to the turbopumps 
intended to alleviate the problems encountered. It is the 
consensus of the several groups that have examined the situation 
that, with continuing development and the present approach to 
certification, an engine with satisfactory and safe performance 
at 109% should be achieved albeit with limited life. This will 
require frequent change-outs and inspections of the 
turbomachinery operationally. 

There is a growing body of opinion that the origin of the 
problems of the turbomachines is of a "systems" nature rather 
than a set of discrete component difficulties. Under such 
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conditions a set of "fixes" to components within the physical 
constraints of the current design would, at best, be of limited 
value. 

It would seem prudent, therefore, to undertake a major 
redesign of the turbopumps as the long-range solution to the 
problems. At the same time, in recognition of the planned rapid 
increase in launch rate and the long time (3-5 years) required to 
design, develop and certify redesigned turbomachinery, provision 
should be made to acquire additional spare turbopumps of current 
FPL design to accomodate the frequency of removals that is to be 
anticipated . 

During 1982 the Panel also emphasized the SSME operational 
planning and status of logistics planning so that the inevitable 
emphasis on turn-around time reduction and turn-around co;sts 
will not introduce additional hazards. It was apparent to the 
Panel that substantial planning had been done but that the budget 
support of such plans may be a major constraint towards the 
attainment of safe rapid turn-around. Specifically; 

o The critical dependence on the performance of the high and 
low pressure turbo pumps for both oxygen and hydrogen, coupled 
with only modest improvements in the mean-time-to-tai lure of 
these elements, suggests that more spares are essential. This 
would contribute to safety and would preclude dependence on 
cannibalizing production elements for flight support. 

o Not apparent in the planning is the development of a 
dedicated facility or function for maintenance and overhaul' 
turn-round of main engines. This will be necessary before 
minimum safe turn-around time and cost is achieved. 

o Proposals within NASA which include contractor operation 
of major elements of the Shuttle or the entire STS for purposes 
of reducing cost should be carefully evaluated for their effect 
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on safety. This is noted in the discussion of the SSME because 
it is felt that operation, testing, inspection, and monitoring of 
flight data is still, and will be for some time, critically 
dependent on experience rather than on developed methods and 
procedures. Shifting turn-around or maintenance responsibilities 
to a separate organization should be approached with extreme 
caution. 

o The decision to purchase another Shuttle is not a 
substitute for a fully developed logistics, maintenance, and 
spates program, which is properly funded. This comment applies 
to the entire STS program. 

Appendix IV contains a more detail report on the above 
summary comments with particular reference to the investigations 
done in logistics and spares planning. 
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IMPROVEMENTwS FOR RO UTIN E OPERATIONS 
NASA ORGANIZATION ARRANGEME NTS 

The challenge of achieving true operationl status for the 
space transportation system is, in many ways, as rigorous a test 
of NASA's management and technical capabilities as the 
development effort itself. Recognition of this tact at NASA's 
top management levels is essential if the management challenge is 
to be met successfully. 


The problem arises, in part, by the Shuttle's progressive 
testing and performance enhancement which will continue well into 
the operational flight schedule. This meatuS that the experience 
and expertise of the development centers and their associated 
contractors must be readily accessible during this shakedown 
period that will last for another 5 years or longer. At the same 
time, however, an effort to build a truly operational system 
within an organizational structure dominated by the development 
centers is likely to fail. This is the cote of NASA's present 
management dilemma. 

The development centers- 'pat ticular ly JSC and MSFC — are not 
attuned by experience or philosophy to the management discipline 
that is essential to a successful commercial operation. Their 
understandable mutual competition within NASA for assignments and 
budgets, and their associated reluctance to let go of areas of 
responsibility once assigned, are serious obstacles to building a 
well-integrated and disciplined operational entity. In other 
words, the decentralization and fragmentation of responsibility 
inherent in a center-based strategy will, in the end, confound 
all efforts to operate the system efficiently through steering 
committees and task groups. At the same time, NASA cannot risk 
cutting itself loose from the centers' experience and expertise. 
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The Panel also recognizes the severe budgetary constraints 
that ate likely to impede realization ot an optimum logistics 
strategy in support ot a routine and reliable commercial 
operation. For example, it would be unrealistics to maintain the 
level ot spares that would routinely be obtained by a commercial 
airline operation. Similarly, a dedicated overhaul facility in 
the vicinity ot KSC may also be an unrealistic expenditure, much 
as it might improve turn-around time. Numerous and difficult 
trade-otts will be needed in this budgetary environment. This 
tact heightens the need tor a clearly defined line of 
r eponsibil ity and authority within NASA to make these decisions. 

It is not the Panel's responsibility to prescribe a specific 
solution to this management dilemma surrounding the Shuttle's 
transition to an operational commercial system. However, the 
significant safety considerations that are directly linked to 
this transition suggest several approaches or principles that 
should be considered by NASA management. 

o The organizational arrangement within NASA that is to be 
responsible tor commercial operation of the Shuttle should be 
determined and announced, even though full implementation of this 
arrangement might not be feasible for the itext several years. 

o As a first step, the management core ot this operational 
organization should be established as soon as possible and given 
authority to resolve major management and budget issues that will 
inevitably arise among the development centers as they support 
Shuttle testing and enhancement during the transition period. 

This core group would logically be situated at NASA Headquarters. 
This is another way of saying that someone at or near the top 
must clearly be in charge to control the natural competition 
among the centers. 

o The relationship of the development centers to the 
operational organization should be one of subcontractors. 
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providing the development skills and expertise as requested on a 
reimbursable basis, Budget and Shuttle performance improvement 
program decisions would be the province of the operational 
organization. 

o The role of the Shuttle Processing Contractor must be 
recognized as evoluntionary , given the Shuttle's continuing 
enhancement and a host of other uncertainties. The operational 
organization within NASA must retain ultimate responsibility for 
the Shuttle's commercial operation, as well as defining the 
i:>pecific roles and responsibilities of the SPC. A similar 
Headquarters control of the roles and responsibilities of the 
potential payload processing contractor should exist. 

o NASA should give serious consideration in the long term to 
establishing the operational organization as a Government 
corporation, in order to achieve effective separation from the 
developmenmt centers which other. 'ise might function as de f acto 
commercial operators of the STS. The benefits of establishing 
such an entity whose sole reason-for-being was the efficient and 
reliable operation of the Shuttle could be significant. At the 
same time, such a separation might enable the centers to pursue 
their historic R&D roles more effectively. 

TRACKING AND DATA ACQUISITION 


Today the Spaceflight Tracking and Data Network (STDN) 
consisting of fifteen ground stations provides less than 20% 
coverage of the Shuttle in orbit. The transmission of both voice 
and commands on the FM uplink from the ground to the Shuttle and 
the transmissin of voice and telemetry on the FM downlink are 
provided by an S-band communications system operating at the 
relatively low data rate of 32 KBPS uplink and 92 KBPS downlink. 
There are four flush mounted antennas on the Orbiter vehicle 
which provide a dual redundant communications path to the ground 
stations. 


In the near future the HTdN will bo augmonfeod by fewo 
oporatlonal Traoklng and Data Relay Satellites in cjeosynchronous 
orbit and separated by approximately 13f> degrees and will bo able 
to extend this eovorago of the orbiting Shuttle to 85 - 90% 

These satellites » also eallod WRSTAR “> together with a ground 
station at White Sands, Now Mexico, constitute the Tracking and 
Data Relay Satellite vSystems (TDRSS) . The system will provide 
NASA with tolocoramunication services as needed. Current plans 
include orbiting a spare satellite between the two active 
satellites that can bo moved into position to replace a failed 
satellite. The Shuttle Orblter S-band system will then bo able 
to communicate with the ground through the TDRSS system and will 
do so whenever it can. 

In addition, a wide~band communications link from the Shuttle 
Orbitor to the ground via the TDRSS system is currently planned. 
This link will be used for on-orbit transmission of 2 MBPS to 50 
MBPS of scientific data and, on a time-shared basis, will also 
accommodate television, analog scientific data, experiment or 
operational tape recorder dumps, etc. A deployable 36 inch 
sfoorablo antenna shared with the Orbiter rendezvous radar 
susbsysbem, operating in the Ku band and stowed in the payload 
hay will bo used for this communications link. Unfortunately, 
this Ku band system is only single-string for budgetary 
considerations but on the surface at least does not appear to bo 
a safety related item. 

When the TDRSvS is proven to bo oporatlonal, all but throe or 
four of the STDN ground stations will bo phased out. The target 
date Is mid-198/ll. Although the direct communication ground link 
will then bo far less than the current 20% coverage, the DOD 
ground facilities at seven locations world-wide will always be 
available as a backup should the satellite relay system fail. 

(It should be noted that this will not be the first time that a 
manned spacecraft has utilized satellites for communication - it 
was successfully demonstrated during the ASTP joint mission with 
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the Russians in the mid-seventies.) 

No plans are currently underway by NASA to assess 
specifically the safety aspects of the new communications system 
and the ASAP has not yet been briefed on the subject. However, 
the Panel will request such a briefing sometime during the 
calendar year 1983. Scheduled tests of the system are planned 
for March and again in August of 1983 and the Panel will 
certainly wish to review those test results. 

SURVIVAL CONCEPTS 


Over the last few years the ASAP has participated in many 
discussions of crew survivability, particularly during the launch 
and possible ditching of the Shuttle as the result of an abort. 
Although the circumstance of a ditching is remote, the conclusion 
of analysts suggests that an intact structure from which escape 
is possible on ditching is not probable. Thus, an ejection 
system operable at lower speeds is perhaps the only practical 
solution to the ditching problem. It should also be configured 
to serve for some launch aborts. The standard ejection seats 
have already been determined to be impractical for more than two 
crew members but there is a current technology in use involving a 
tractor rocket that lifts a person through a suitable opening. 
Concepts show that after ejection of four crew members, the 
succeeding flight crew (nembers move into position at the cabin 
opening before firing their rockets. This solution is very 
complex, but the Panel recommends that NASA study its application 
to the Shuttle with two to six crewmen and determine the cost 
to install in a new Shuttle as well as the cost and feasibility 
of retrofitting current Orbiters. 

The Panel feels that an even more likely problem is a ground 
incident occasioned by a blown tire or gear failure on landing. 
Immediate ejection could not only save a major number of the 
crew, but would open more escape routes. This should be analyzed 
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in detail because a landing incident is believed to be more 
likley than the ditching or a major launch malfunction. 

ROLE OP CREW VS. GROUND 


The teal time control and management of space missions by 
Mission Control has served well but requires extensive and 
expensive communications if continuous control is, in effect, 
to be maintained. This was necessary during the test mission of 
the STS and desirable where Shuttle misions are unique and 
relevant experts can be gathered at Mission Control. In the case 
of the Shuttle as a transport system, substantial economies would 
result if a greater degree of reliance on the crew were to be 
achieved. The crews must be permitted and aided to develop a 
reliance on their own capabilities in emergencies that may occur. 
It is suggested that crews should be encouraged to work toward 
the routine execution of the entire mission, calling upon ground 
assistance only in unusual situations. The ultimate savings will 
only be realized if the entire operational support structure is 
streamlined as a result of flight experience and appropriate 
divisions of responsibility are achieved. 

ASAP PRIORITY LIST OF SAFETY IMPROVEMENTS 

Over the years a number of suggestions have been made by the 
ASAP not to emphasize major hazards in the current design of the 
Shuttle systems but to note those systems which do not appear to 
be sufficiently simple or to have adequate safety back up and 
must, therefore, demand "every flight" detail checks and 
inspections before safety can be assured. The ASAP feels that 
NASA has not done a comprehensive study of this type of systems 
improvement but has concentrated primarily on improvements to the 
payload performance. As in prior reports and letters to NASA, 
the ASAP suggests such a review of the consistency of redundancy 
in the Shuttle systems designs and the potential for changing 
entire systems concepts to simplify operations by permitting 
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quick turn-arounds without "every flight" attention to the 
potential safety performance of the subsystem. 

Without such a study it is not possible to defend any 
particular priority listing but the ASAP, on the basis of its 
collective judgment continues to feel concern about the following 
systems : 

o The APU system - particularly the APU installation in the 
solid propellant boosters, 

o The rudder-speed-brake mechanical control system 
downstream of the drive motors, 

o The landing gear system, particularly the wheels and 
tires (can the ground attitude of the Orbiter be 
modified?) . 

o Crew escape (for maximum number) at launch and prior to 
potential ditching or during and after a landing 
accident. 

o EVA system to reduce time from decision to emergence. 
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POLICY I SSUES FOR OPERATIONS 

Whatever NASA decides to do with respect to organizational 
structure to support routine operations o£ the Space 
Transportation System, it appears to the ASAP that Headquarters 
attention should be directed to the creation or clarification of 
broad NASA policy in several critical areas. These include; 
logistics and maintenance planning, certification, configuratin 
control, and component life determination. A brief discussion 
under each of these headings follows; 

LOGISTICS AND MA IN TENA NCE PLA NNING 

A comprehensive overall integrated logistics plan for the 
entire Shuttle system is essential and overdue. This should 
include all major elements; e.g., Orbiter, ET, SRB, SSME, OMS & 
RGS, etc. Overhaul and repair facilities as well as spares 
stocking and warehousing issues should also be addressed. The 
plan should address the "near term" problems specifically and 
give an outline of the "longer term" requirements. Even if this 
plan is altered shortly after issue, the discipline entailed in 
its preparation will have served its purpose. 

A maintenance plan for the entire system should be evolved 
along the lines of the PAA Maintenance Review Board philosophy. 
This can be either a part of the plan in the preceding paragraph 
or alternatively developed as a separate task. It will be 
required, however, to examine the adequacy of the present spares 
procurement quantities. 

The Maintenance Engineering Analysis (MEA) or Failure Modes 
and Effects Analyses (FMEA) process for all components of the 
Orbiter is admirably thorough but may be exhaustive and, 
therefore, completed too late to be of value for the plans 
mentioned in the two previous paragraphs. While MEA's will be 
essential for major components, a more practical approach using 
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flight line and launch pad experience should be considered in the 
interests of placing spares orders immediately, A small task 
force could probably accomplish this if given a suitable mandate. 

The spares quantities which have been ordered thus far and 
which were declared in General Abrahamson's logistics status 
review at KSC on November 9 to be essentially completely 
delivered in some cases, are probably insufficient. The small 
task force referred to in the previous paragraph could examine 
this question, but if the spares of SSME’s and their major 
component are any criterion, then there may be a problem. 
Certainly in the interest of safety we cannot continue the 
present practice of "cannibalization" and robbing of the 
production line to meet each launch date. 

The prospect of eliminating or reducing the coverage of 
certain maintenance manuals, illustrated parts catalogs and 
wiring diagram manuals in the interest of economy is viewed with 
dismay. The success of the current concept, especially in the 
longer term (say 1990) , will be partly dependent upon adequate 
and accurate publication. 

The "sustaining engineering" function should be critically 
examined to avoid duplication between NASA and the Shuttle prime 
contractors. If it is eventually vested in the SPC group, it 
should draw skills from each major contractor and take due notice 
of the problems of continuity of experience which might be 
endangered by attrition, retirements, and the like. Obsolescence 
of some of the equipment; and disappearance of some smaller 
vendors will be a special problem in this respect in the"longer 
term." 
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In addressing the above, it may be useful to study "Notes on 
Relationships of Shuttle Program to Commercial Airline Logistics" 
November 20, 1982, included as appendix V of this report. 

IHE CERTIFICATION PROCESS 


In the process of reviewing changes for performance 
improvement and the basis for certification, the ASAP is 
concerned that the certification process for such changes is 
inconsistent, i.e., the rigor of the originally specified 
certification process. 

Examples of changes that may have had less rigor in their 
certification are: the safety factor reduction in the new light 

weight external tank and the decision not to test to ultimate 
load, the substitution of <iuilted material for the silicon 
thermal protection tile over large areas of the Orbiter. Taking 
such actions during an experimental program is inevitable, but 
steps should be taken to complete certification of all 
significant changes. 

The suggestion by the ASAP is that NASA Headquarters 
institute r review of the total certification process for Shuttle 
hardware as well as support functions such as software 
certification, ground support processes, maintenance monitor ing , 
etc. It is further suggested that the policy for certification 
and the approval for deviation be a Headquarters responsibility. 
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CONFIGURATION CONTROL 

The objective of a certification program for a vehicle is to 
validate that all of its parts in fact perform together as a 
completely configured system. Substitutions of components or 
subsystems that have not been involved in such a formal 
integrated test program could invalidate the certification status 
of the vehicle by changing its configuration. 

Several times during the year the Panel was presented 
with information regarding configuration identification program 
related to the initial builds underway for the remaining Orbiter 
vehicles. However, at some of the subsystem levels the detailed 
configurations have not always been determined. For example, 
while investigating the logistics support plans for the SSME, we 
found that complete indentured parts list does not yet exist for 
full-power engines. We believe there are many issues still open 
on the final full-power engine configuration. Lack of a detailed 
indentured parts list is cause for concern with regard to even 
defining explicitly the baseline for a configuration control 
program on the SSME. 

Shortly before the STS-5 launch there was even some 
discussion as to whether all three engines would have the same 
certified configuration as a result of the impeller damage on the 
pump of one engine and lack of an available replacement with 
identical configuration. Although this problem was "resolved" by 
using the damaged pump, it highlights another issue; namely, how 
to maintain a certified system configuration without an adequate 
supply of configured components for replacement. 

Because changes are being continually introduced to correct 
problems identified either during development or from flight 
operations, it is likely that each of the four Orbiter vehicles 
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will have different, as-integrated, configurations at the 
detailed level. This may be true also in the case of the 
external tank and the solid boosters; at least for the next 
several years. Furthermore, the extremely limited replacement 
hardware supply will cause changes to the as-integrated 
configurations through substitution of new design components or 
cannibalization of older design components. This is particularly 
probable on the engine, power supply and electronics subsystems. 

It is the Panel's opinion that NASA must adhere to a rigidly 
disciplined methodology in which each vehicle's configuration is 
identified and recorded in detail, and .its individual 
certification status maintained. There should be no planned 
substituion of components without a full understanding of the 
implications to the overall system operation and safety. The 
computerized configuration and validation records combined with 
change control rules should also form the basis for the logistic 
maintenance and reliability programs. One must particularly 
guard against changes made under the pressure of an imminent 
launch schedule where system implications cannot always be 
identified nor assessed. 

An example that amplifies the above concern was raised by the 
premature separation of the parachute riser lines on the SRB 
cases during STS-4. In this case, a change in operational 
concept was coupled with a hardware change. However, it appears 
that a change in switch sensitivity may have occurred which 
resulted in the riser line release at the low g-level of the 
frustum separation event. The important safety implication is 
that an adequate vehicle Configuration Control Program involves 
not only the documentation of a fully certified system 
configuration and a disciplined change authorization procedure, 
but also quality control at the field level to assure that 
components changed are as specified. 
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COMPONENT LIFE DETERMINATION 


In the design and development process for the Shuttle system, 
specifications were set up for each element and then a test 
program devised to demonstrate that the component would qualify 
for the desired life under the postulated conditions. Now that 
the Shuttle is flying, we have the opportunity to check whether 
or not the real conditions are as predicted and to determine the 
actual life of the component. This information is not only 
needed in the spares and logistics program, but will establish 
what the real margin of safety is for the various subsystem of 
the Shuttle. These data are vital for the guidance of the 
sustaining engineering program and must be obtained even though 
the necessary test and inspection may increase estimated costs 
and lengthen the turn-around time in the near term. 
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FLIGHT SAFETY FOR NASA AIRCRAFT OPERATIONS 


During 1982 a series of accidents in aircraft operations made 
it clear that further emphasis on operational safety for support 
and test aircraft was necessary throughout the NASA organization. 
The ASAP, responding to a specific request from Administrator 
Jan, s Beggs, issued a letter report on September 13, 1982 (see 
Appendix VII) . 

Following the Panel report, NASA Headquarters initiated 
reviews of JSC and LaRC by ECO System International Company 
resulting in their report "NASA Plight Operations Review". In the 
ECO report, as well as the ASAP review, studies of the 
distribution of accidents as to cause such as weather, pilot 
error, powerplant, etc., have shown, that pilot error is the 
principal culprit. This is true whether the class of operation 
is commercial airline, general aviation, or military. There is 
no reason to believe that NASA flight operations are any 
different. 

Assuming that pilot error will be the principal cause of 
future NASA accidents, it is clear that the normal management 
approaches to discipline and procedures must be augmented and 
monitored . 

Pilot errors can be attributed to training, current 
proficiency, physical condition, and mental attitudes such as 
carelessness or lack of patience. NASA has special problems 
because of the variety of its flight operations and the wide 
spectrum of pilot experience. 

Supervision is a necessary, but not sufficient, condition to 
combat pilot errors. Selection, training, proficiency, and 
physical conditioning are some of the factors that can be 
monitored but when the wheels come up into the wells, the pilot 
is on his own and pilot attitude governs flight safety. 
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Pilot attitudes are a result experience, training, and by 
examples set by other pilots of established reputation. In this 
respect, NASA has a wealth of expertise that can make a major 
contribution. The ASAP suggests an education program that could 
be sponsored by the Intercenter Aircraft Operations Group (ICAOG) 
which could take the form of a series of "leadership" seminars to 
be given at weekly (or monthly) flight safety meetings held at 
various centers. 

The "stable" of experienced and famous test pilots NASA 
employs is large. It is felt that a series of seminiars on 
interesting subjects by selected speakers would instill in the 
younger and less experienced pilots an appreciation of the 
disciplines and attitudes that make for safe flying and allowed 
these senior pilots to achieve a remarkably accident free career. 

The program could include: 

1. The flying characteristics of the B747 and the problems 
of trucking the Orbiter across the country. 

2. LaRC discussing stall and spin avoidance and recovery 
techniques . 

3. The pilots could give a talk on traffic control and 
communications around and approaching busy airports like JFK, 

LAX, O'Hare, Atlanta, and Washington National. 

4. DFRC might decribe some of the special techniqes and 
precautions taken in establishing speed and altitude records. 

5. Review experiences in flying large delta-wing aircraft 
or swlng^wlng type aircraft as well as the SR-71 , B-1 and others 
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6» Some of the hazards exposed and lessons learned through 
the NASA Aviation Safety Reporting System could be discussed by 
an appropriate speaker from Ames Research Center. 

NASA response to previous recommendations has been entirely 
positive although all programs based on these suggestions have 
not as yet been implemented. The extent to which the centers 
implement standard, cooperative programs and the progress on 
utilization of the Intercenter Aircraft Operations Group will be 
reviewed and monitored by the ASAP in 1983. 
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During 1983 the ASAP intends to concentrate on the progress 
of the space Shuttle flight experience with particular emphasis 
on the confirmation of the design flight envelope, maximum c.g. 
limits, maximum landing weight, and maximum reentry heat load. 

In addition, particular attention will be paid to those systems 
that should continue to have individual inspection, 
refurbishment, or flight-to-fl ight replacement to maintain safety 
in routine operations. 

In addition, the ASAP intend to concentrate on the 
improvement of systems to enhance performance or reduce cost and 
to be certain that such changes do not add extra hazards. It is 
hoped that such changes will be made for the specific purpose of 
reducing hazards. It is the conviction of the ASAP that changes 
which reduce specific requirements for fl ight-to-fl ight 
maintenance or part replacement will not only reduce hazards but 
also cost of operation. 1983 should see the use of the heads-up 
cockpit display making possible the demonstration of autolanding. 

Changes now planned that will require specific attention are 
the light weight external tank and the filament-wound solid 
rocket propellant cases. These designs will be followed as they 
mature. Not yet planned nor defined are changes to reduce the 
hazard to the crew in a number of potentially survivable 
incidents such as ditching, launch malfunctions, and hard 
landings. Elsewhere in this report the ASAP has suggested a 
serious study of progress if it is initiated. 

As operations expand there will be a variety of payloads, 
many of which may have the potential of increasing the hazards 
for routine operation. Of particular concern are the payloads 
which have propulsion and pyrotechnic elements or extend beyond 
the payload bay door envelope. Of particular interest is the 
wide- tank Centaur. 
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A major change in Shuttle communications and geographical 
communication coverage will take place with the introduction of 
the TDRSS satellite based communications system. During 1983 the 
Panel will review the details of this system and the potential it 
has for hazards or the removal of present hazards to safe 
operations . 
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NASA AEROSPACE SAFETY ADVISORY PANEL 
APPENDIX T. 

LISTING OF PANEL ACTIVITIES FOR CY 1982 

Panel fact-finding sessions have been conducted on the 
average of three times per month for 1982. Members and 
consultants have during this same period visited six NASA centers 
and facilities (ARC, DPRC, LaRC, JSC, MSFC, KSC) as well as NASA 
Headquarters, and three NASA prime contractors. Although these 
have been focused on the Space Transportation System, there have 
been a number of fact-finding visits aimed at reviewing and 
assessing aeronutical operations and attendant flight safety. 

The Panel has, where practical, participated in a number of 
significant in-house reviews; e.g.. Plight Readiness Reviews, STS 
Mission Control activities. Panel efforts have been supported by 
the Panel Staff Director through in-depth and continuous 
participation and reviewing of STS program/project activities and 
aeronautical R&D and administrative flight safety activities. 

The breadth of Panel discussions goes from the NASA 
Administrator and Deputy Administrator to Program Directors 
on into the subsystem design and test personnel (the "hands-on" 
people). Beyond this is the Panel’s annual report provided to 
the NASA Administrator and through testimony before the 
appropriate House and Senate subcommittees in January-March 
period. VJhere requested, the Panel provides individual support 
to special review teams' such as the Solid Rocket Booster STS-4 
Review Group and the Shuttle Main Engine (SSMB) Assessment Group, 


ORiGimi PAGS 

OF POOR QUALITY 


OF POOR QUALITY 


41 


APPENDIX I 


SUBJECT; Panel Fact-Finding Sessions, CY 1982 


Date 

Location 

Attendees/Subject 

1/21/82 

Headquarters 

Annual meeting, 1981 
activities (Panel) 

2/24/82 

Wash . , DC 

Testimony before 
Congress (Panel) 

2/25-26/82 

JSC 

Discuss results derived 
from STS-2 which affect 
future fight/mission 
hardware (Panel) 

3/9-10/82 

KSC 

STS-3 Plight Readiness 
Review (Parmet, 
McDonald, Hawkins) 

3/15/82 

Headquarters 

Plight test activities, 
aero safey meeting 
w/Beggs (Davis) 

3/20/82 

KSC 

L-2 review for STS-3 
(Hawkins) 

3/21-22/82 

JSC 

STS-3 mission control 
room (Davis) 

3/28-29/82 

JSC 

MCC operations./ 
preparation for landing 
STS-3 (Davis) 

4/26-28/82 

Rocketydne 

SSME status (Himmel) 

5/5-7/82 

HQ/MSFC 

Met w/codes 0 & M STS 
development & operation 
ET, SRB, SSME status 
(Panel) 

5/10-11/82 

LaRC 

Aircraft flight safety 
(Davis) 

5/18-19/82 

MSFC 

SSME FPL incident 
(Himmel) 
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5/26/82 

6/10/82 

6/11/82 

6/14-16/82 


6/22-23/82 

6/25/82 

0/26/82 


6/30- 

7/4/82 

7/7-9/82 

7/19/82 


8/2-5/82 


8/9-13/82 


8/9/82 


Headquarters 


MS PC 


RI/SD 

KSC 


KSC 

KSC 

KSC 


Orbiter capability, 
assessment, expendable 
launch vehicle, etc. 
(Hawkins) 

Filament wound case tor 
solid rocket motor 
(Hedrick) 

STS structural adequacy 
(Hedrick) 

STS- 4 FRR; SPC 
discussions & briefing 
(Battin, Parmet, Grier 
were at SPC & FRR: Davis 
at FRR) 

SSME task force 
(Himmel) 

FRR (Grier) 

STS-4, L-2 review 
(Grier ) 


JSC 

DFRC/ARC 

Michoud 

Assembly 

Facility 

HQ/MSFC 


Rl/Palmdale 

RI/Downey 


DFRC 


Mission control room 
STS-4 (Davis) 

Aviation Safety (Davis) 
Light weight external 
tank (Hedrick) 

Chief Engineer's review 
Panel re SRB failure on 
STS-4 (Himmel) 
Logistics, SSME, STS & 
Orbiter performance 
Palmdale operations 
(Panel) 

HUD, SIMS tor STS 
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8/19-20/82 


8/26/82 

9/13/82 

9/14-15/8? 

9/16-17/82 

9/28/82 

10/1/82 

10/25/82 

10/25-27/82 

11/2/82 

11/3-4/82 

11/8-11/82 


[:J 

QUAUfY 


Ames/DPRC 


ARC 

Headquarters 

RI/Downey 

JSC 

Rocketdyne 

Headquarters 

KSC 

KSC 

RI/Downey 
C. Draper Lab. 
KSC 
KSC 
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missions (Davis) 

Discussion on 
similarities between 
Orbiter & SR 71 landing. 
Discussin w/test pilots 
at DFRC on landing 
characteristics (Davis) 

Orbiter TPS (Hawkins) 

EVA meeting (Hawkins) 
•STS-5,-6 design 
certification review 
teleconference (Grier) 
HUD, landing gear, crew 
egress (Davis, Rothi) 
SSME logistics & status 
(Elverum & McDonald) 
STS-4 anomolies & STS-5 
configuration 
differences (Parmet) 
STS-5 FRR (Grier, 
Elverum, Rothi) 

SSME Management Overview 
Board Meeting (Himmel) 
Orbiter; Applicatin of 
Airline method-logistics 
and spares (McDonald) 
Stability and control of 
the Orbiter on re-entry 
and touchdown (Davis) 
Management council 
meeting; STS-5; L-2 
review (Panel) 

Orbiter structures 
capabilities (Hawkins, 


11/22-23/82 
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12/13-14/82 KSC 


Hedrick, Cohen) 
Technical Readiness 
Review for FRF (Roth, 
Himmel) 
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Membership List of the AEROSPACE SAFETY ADVISORY PANEL 

CHAIRMAN 


Mr, Willis M, Hawkins (9/88)* 
Senior Advisor 
Lockheed Corporaton 
P.O. Box 551 
Burbank, CA 91520 


MEMBERS 


Dt , Richard 'i\. Battin (4/86) 
Associate Department Head 
Charles Stark Draper Lab, Inc. 
555 Technology Square 
Cambridge, MA 02139 


Mr. I. Grant Hedrick (11/85) 
Presidential Assistant for 
Corporate Technology 
Grumman Aerospace Corporation 
Bethpage, NY 11714 


Lt. Gen. Leighton I, Davis (12/83) 
USAF (Ret.) 

Consultant 

729 Stagecoach Road, Four Hills 
Albuquerque, NM 87123 

Mr. Gerard W. Elverum, Jr. (4/88) 
Vice President-General Manager 
Applied Technology Division 
TRW Space and Technology 
Redondo Beach, CA 90278 


Mr. John F. McDonald (6/86) 
Former Vice President 
Techncial Service 
TigerAir, Inc. 

3000 North Clybourn Avenue 
Burbank, CA 91505 

Mr. Norman R. Parmet (3/88) 
Consultant 
5907 Sunrise Drive 
Fairway, KS 66205 


♦Appointment terminates (-) 
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Mr. Herbert E. Grier (1/85) 
Consultant 

2223 Avenida de la Playa 
Suite 304 

La Jolla, CA 92037 


Mr. John G. Stewart (4/86) 
Assistant General Manager 
Tennessee Valley Authority 
400 Commerce Avenue - E12B18 
Knoxville, TN 37902 


CONSULTANTS 


Dr. Seymour C. Himmel 
12700 Lake Avenue 
Apartment 1501 
Lakewood, OH 44107 


Mr. Robert D. Rothi 
6 Chuckwagon Road 
Rolling Hills, CA 90274 


EX-OFPICIO MEMBER 


Dr. Stanley I. Weiss 
NASA Chief Engineer 
NASA Headquarters 
Washington. DC 

STAFF 


Mr. Gilbert L. Roth 
Staff Director, Aerospace Safety 
Advisory Panel 
NASA Headquarters 
Washington, DC 20546 
A/C 202 755-8381 


Ms, Susan Webster 
Advisory Committee Assistant 
NASA Hdqrsc Code LB-4 
Washington, DC 20546 
A/C 202 755-8380 
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BACKGROUND MATERIAL FOR 
LIGHT WEIGHT EXTERNAL TANK 
ASSESSMENT 


Discussion 


The shell structure should be able to maintain its structural 
integrity, i.e., not collapse or rupture, at values of loads up 
to some safe value (called ultimate load) above the maximum 
expected operational load (called limit, load) . Th^ ratio 
ultimate load/limit load is called factor of safety (P.S.) . A 
factor of safety is used to provide protection against 
uncertainties in load, material properties, manufacturing 
variations, etc. 

The F.S. in general use for aircraft is 1.5. An F.S. of 1.4 
was adopted for general use in design and certification of the 
STS, and the HWT was designed for an F.S. of 1.4. For the LWT 
the F.S. was reduced to 1.25 for loads categorized as 
"steady-state" or "well defined." The original F.S. of 1.4 was 
retained tor loads categorized as "dynamic" or "all other". The 
composite F.S. equals 1.265 in the critical design condition for 
LH^ tank shell buckling. 

HWT Static Strength Test - The HWT was static tested in the 
MSFC vertical test stand in 1979. The critical test areas were 
submerged in liquid hydrogen so that material strength properties 
would be the same as in actual operating conditions. The LH 2 
section of the HWT was pressurized to 32 psi, which is the lower 
limit of flight pressurization (the lower limit is critical for 
shell buckling) . The maximum level of Orbiter thrust load 
applied is uncertain since it is reported as 113.5 percent of 
limit in one part of the test report and 130 percent in another 
part of the same report (MMC-ET-TM03-0 , Volume III, 


"External 
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Tank LH 2 Strength Test Report). The HWT test specimen did not 
show any signs of distress at the load levels imposed. 

LWT Static Test for Buckling - A limit load verification test 
was run on LWT-2 in the horizontal proof test stand at Martin 
Marietta's Michoud, Louisiana, plant. Gaseous nitrogen at room 
temperature was used in the LH 2 section to provide an internal 
pressure 23 psi greater than ambient. The 23 psi differential 
pressure was held constant while external loads were applied to 
produce the "equivalent" V of 100 percent design limit axial load 
in integral skin/stringer shell at the area2/ 
that was predicted by analysis to be most critical for panel 
buckling. 


3^/"Equivalent" is used here to indicate that the design limit 
load was reduced to account for the reduced modulus of elasticity 
of the 2219-T87 aluminum material at room temperature compared to 
the operating temperature of -423oP, i.e., loads are divided by 
the factor (12.4 X 10<^ )/10.8 X 10^ ) = 1.1 

V"The STAGS-C analysis by Martin Marietta indicated that the 
minimum margins for compressive buckling occurred at the 10; 30 
and 1:30 o'clock positions at Station 1702. 


This test was carefully run so as not to exceed the local design 
limit stress. Because the internal pressure, which is 
stabilizing, was only 23 psi rather than the minimum operational 
value of 32 psi, it is estimated that the test demonstrated 
approximately 109% of limit load or 119% (i.e., 1.09 x 109) at 
rated power level of the main engines. It provides no margin to 
cover any variation in load or variation in strength. It is 
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unlikely that all LWT's will have strengths greater than LWT-2. 

LWT Proof (or Acceptance) Test - In addition to the static 
test for buckling just described, which was performed on LWT-2 
only, each production LWT receives a burst proof test as an 
acceptance test. These acceptance tests are run in the 
horizontal test stand facility at the Martin Marietta plant at 
Michoud, Louisiana. The acceptance test is designed to impose the 
"equivalenf’J./ percent of limit load tension on all welds. 

The internal pressure alone is sufficient to proof load the axial 
welds, but five different combinations external loads are used in 
addition to the internal pressure to attain the proper loads on 
the circumferential welds. This proof test contributes nothing 
toward the verification of required compressive buckling strength 
of the LH^ tank shell. 


V"Equivalent" is used here to indicate that the proof 
pressure was reduced to account for the reduced toughness of the 
2219-T87 aluminum material at room temperature compared to the 
operating temperature of -423oF, i,e,, pressures are divided by 
the factor 1,1, Since the high side of the flight ullage 
pressure regulation band is 34 psia and the LH^ under flight 
acceleration is 6,4 psi then the proof pressure 


P(proof) = (40,4 X 1,05)/1,1 = 38,6 psig 
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STABILITY OF SPACE SHUTTLE EXTERNAL LIGHT WEIGHT TANK (LWT) 


David Bushnell and Bo Almroth 


ABSTRACT 

The next and future launches of the Space Shuttle will include a 
redesign external (disposable) tank. This tank is of lighter 
weight than that used to date. It has been tested to design 
limit load, not to ultimate load. During a certain phase of the 
launch there are regions of the tank subjected to destabilizing 
loads generated by the thrust of the Orbiter engines. Recently, 
the Aerospace Safety Advisory Panel, a committee that advises 
NASA Headquartes on issues involving the Space Shuttle, expressed 
concern about the adequacy of the new design with regard to 
buckling. The committee recommended that experts in the field of 
shell buckling be called in to evaluate the new design, render an 
opinion of safety, and make recommendatiotTS about possible 
further analyses and tests. David Bushnell and Bo Almroth were 
selected by the Panel and by NASA Headquarters to perform these 
tasks. On December 9th and 10th Bushnell and Almroth visited the 
Martin Marietta Company, Michoud Division, New Orleans, in order 
to evaluate the light weight tank design with regard to buckling. 
On December 11th they, representatives from Martin Marietta, the 
Aerospace Safety Advisory ptftnel, and NASA officials met at NASA 
Headquarters to discuss tna buckling issue. As a result of 
Bushnell' s and Almroth' s evaluations, it was decided that the 
light weight tank could be flown on the next Shuttle launch 
without further analysis, but that nonlinear analyses with the 
use of the STAGSC-1 computer program should be performed with an 
eye toward future launches, during which the destabilizing loads 
are expected to be somewhat higher than those on the next flight. 
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BACKGROUND AND PROBLEM DEFINITIONS 

On Wednesday, November 24, 1982, Willis Hawkins, in his 
capacity as chairman of: the Aerospace Safety Advisory Panel tor 
NASA's Space Shuttle program, telephoned David Bushnell about a 
buckling issue in the Space Shuttle external tank. Hawkins asked 
Bushnell to call Grant Hedtick for details. That afternoon, 
Bushnell, Almroth, and Hedrick held a telephone conference in 
which Hedrick defined the issue. 

Figure 1 shows the Space Shuttle external tank (ET) . At a 
certain phase of operation following launch, local regions of 
axial compression develop just forward longerons by means of 
which Orbiter thrust loads are transferred to the external tank. 
In this region the external tank, which contains liquid hydrogen 
and is internally pressurized to 32 psi, must be designed so that 
it will not buckle under the combined hoop tension and axial 
compression. The tank is stiffened internally by stringers with 
T-shaped cross sections, shown in Figure 3. (First two rings 
in the foreground are typical.) 

On Space Shuttle flights to date the disposable external tank 
has and an inert weight of 73.00 pounds. This tank, henceforth 
called "heavy weight tank" (HWT) or "standard weight tank" (SWT) , 
was tested under cryogenic conditions to an ultimate load of 1.40 
times design limit load. Because of the need to reduce weight, a 
new lighter weight disposable tank has been designed, henceforth 
called "light weight tank" (LWT) , with an inert weight of fiOSOO 
pounds. About half of the weight saving came from structure; the 
skin between stringers was reduced in thickness in certain areas, 
the cross sections of certain rings were reduced, and material 
was taken out of the aft portion of the large longerons by means 
of which orbital thrust loads are transferred to the LH^ tank. 


The new light weight tank has been tested to design limit 
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load in the horizontal proof test stand St Martin Marietta's 
Michoud, Louisiana, plant. A new definition of ultimate load, 
1.25 times design limit load, has been acdepted. Buckling 
analyses conducted at Martin Michoud by bale Karr indicate that 
the new tank will withstand the new ultimate load. The new tank 
will fly on the next launch, how planned for January, and on 
future Shuttle flights. 

Due to the pressures of time and money there is currently no 
plan to test the new tank to the new ultimate load. This lack of 
a test on a stability-critical structure designed to a lower 
margin over design limit and than the previous tested tank 
worried Hedrick. Accordingly, as a member of the Aerospace Safety 
Advisory Panel, he advised that an independent evaluation of the 
analysis methods and the new design with regard to buckling be 
carried out. Bushnell and Almroth were consulted as experts in 
this field. 

After the telephone conference with Hedrick, Bushnell called 
Hawkins on November 24 to request that Hawkins officially 
introduce Bushnell and Almroth to whoever at Martin Michoud has 
overall responsibility for the structural integrity of the 
Shuttle external tank. Bushnell and Almroth would then gather 
enough data from Martin in order to render an opinion. 

On Friday, December 3 Gil Roth at NASA Headquarters contacted 
Bushnell at Lockheed. Roth requested that Bushnell contact A1 
Norton at Martin Michoud to set up a visit by Bushnell and 
Almroth on Decemer 9th and 10th at Martin in order to 
learn details of the geometry and buckling analysis conducted at 
Martin. Bushnell first called Norton, who directed him to Dick 
Poll. Foil knew about the proposed visit to Martin by Almroth 
and Bushnell; he was agreeable to the proposed dates of the 
visit; and he supplied the name, Jon Dutton, manager of the 
department reponsible for the analysis of the Shuttle external 
tank. Bushnell called Dutton in order to obtain certain details 
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of geometry and loading that would permit some analysis to be 
conducted at Lockheed with PANDA, B0S0R4, and possibly STAGSC~1 
before the visit on December 9th and 10th. These details were 
supplied to Bushnell on Friday afternoon, December 3 by Dale 
Karr . 


Following the telephone contacts at Martin Michoud, Bushnell 
called Roth at NASA Headquarters to confirm the dates of Almroth 
and Bushnell 's visit to Martin. Roth told Bushnell that there 
would be a meeting at NASA Headquarters on Saturday, December 11, 
in General Abrahamson's office to discuss the buckling issue and 
to learn the opinions of Almroth and Bushnell. This meeting 
would be attended by General Abrahamson, Gil Roth, Willis 
Hawkins, Grant Hedrick, A1 Norton, Dick Foil, Jon Dutton, Bo 
Almroth, David Bushnell, people from NASA Marshall Space Flight 
Center (MSFC) , and others. 

On Friday, December 3 and Monday and Tuesday, December 6 and 
7, Bushnell conducted buckling analyses of the local regions of 
the Shuttle external tank subjected to compressive stresses. 

PANDA and B0S0R4 runs were made. Results from these two programs 
agree with each other for cases in which both apply. A 
preliminary conclusion, from the data supplied by Dale Karr over 
the telephone and from PANDA and B0S0R4 calculations based on 
these data, is that the new, lighter weight Shuttle external tank 
has sufficient margin with regard to buckling. 
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LH7 barrel - SKIN STRINGER 



Panel configuration In buckling-crltical region 
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APPENDIX IV 
MAIN ENGINE 


September 29 , 1982 


TO: Willis M. Hawkins 

FROM: Jerry Elverum and John McDonald 

SUBJECT: NASA-ASAP Visit to Rocketdyne to Examine SSME Logistics 
and Support, September 28th 

As noted in Gil Roth's memo of August 18th (page 2) we visited 
Rocketdyne, Canoga Park, to review the logistics and support 
aspects pertinent to the SSME. A detailed presentation was given 
to us and two copies (BC 82-223) have been sent by Rocketdyne 
directly to Gil Roth. The program was divided into two main 
parts: 

(a) turn-around operations and maintenance together 
with support systems, and 

(b) an outline of the precepts upon which the support 
activities are being based. 

Vince Wheelock (SSME Logistics Manager) presented part "a" and 
his Chief of Schedule Management, Harvey Colbo, gave part "b". A 
copy of the Rocketdyne organization chart is attached hereto 
(attachment 1). Persons also attending are listed in attachment 

2 . 

These notes will include a discursive commentary upon the 
material presented to us, together with selected charts, and will 
conclude with some more specific recommendations of a form 
suitable for adaptation to the ASAP annual report. 
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MATERIAL PRESENTED AND DISCUSSION 


Opening comments were that flight data were being continuously 
analyzed for maintenance action but it was conceded that there 
were just not enough data available yet from the four flight to 
refine the assumptions made - really prior to STS-1. It was 
stated that thee studies really commenced in the definition phase 
beginning in 1972 and used extensive Saturn experince background. 

External visual inspections on the SSME were described followed 
by the turbopump breakway torque and axial shaft travel 
pre-flight checks. Internal inspections of the entire powerhead 
assembly and the main combustion chamber were outlined - these 
consisting principally of borescope ports using both fibre=optic 
and rigid borescopes. Camera (35 mm) shots can be taken in some 
cases - mostly with rigid borescope applications. Drying purge 
of the combustion chamber and various leak checks were described 
including checks with throat plugs installed. 

Electrical checks look fairly straightforward, probably the least 
familiar to mechanics being controller memory read-out. All the 
preceding checks are accomplished with the Orbiter in the 
horizontal position but some, such as high-pressure fuel 
turbopump removal are time consuming tasks as the unit has to be 
disconnected from its ducts etc,, and slid out on "Thompson 
rails" (a piece of GSE) every second flight. 

The Rocketdyne team at KSC to accomplish all this seems to number 
about 35 men, about half of whom are involved on each shift in 
the pre-launch activities. Some 13 technicians, 4 inspectors and 
2 or 3 engineers are normally required but like all critical 
borescope viewing techniques the "Mark I eye-ball" confidence 
will probably be placed in just one or two men who possess great 
experience. This connotes a critical training problem as launch 
rates increase. 


ORIGINAL IS 
OF POOR QUALITY 


62 


Readiness maintenance tests with the whole Shuttle assembly on 
the launch pad were described and a few unscheduled maintenance 
items have been identified. Environmental protection sets 
(covers) for the SSME and for the RCS and OMS engine were 
described, but their installation after landing is rather 
difficult and time consuming because of the height from the 
ground. More specifically, only three sets exist at present - 
one at KSC and the other being available to be ferried to White 
Sands, Hickam, Kadena, Rota or Dakar as the abort case might be. 
The SSME’s would have to be removed to provide ferry range-weight 
capability out of Dakar, Hickam and Kadena. 

When the craft is on the launch pad at KSC the availability of 

only one set of SSME GSE means that each engine at the present 

time has to be worked on in series. It apparently takes six 

shifts or approximately 48 elapsed hours to remove the old engine 
and install the new. The usual supporting logistics analyses 
including resources such as facilities, maintenance crews, 
training, spares, handbooks and manuals etc. appear to have been 
well thought out and are based upon a DOD philosophy - e.g,, 
organizational, intermediate and depot levels and a maintenance 
plan has been established to suit. Training manuals have been 
prepared and courses planned. 

MTBR studies have been made of all principle components and 
assemblies and. engine overhauls have been scheduled based lacgely 
upon these values. Support of this wide base of materiel was 
said to be "in the short term" based upon existing vendors’ 
facilities and production units whereas, "in the long term" it 
would revolve around "dedicated facilities and systems." The 
terms were not defined in years and we drew the conclusion, 
erroneous perhaps, that they were feeling their way both in terms 
of experience with the flight hardware and available funding 
downstream. 
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The all-components total MTBR plots fot the period 1976 through 
1980 based upon test stand data and earlier similar engine data 
ate shown in attached Chart C-9 and Rocketdyne expressed 
confidence in the conservatism of these based upon their approach 
of factoring the MTBR value. Chart C-9 shows this overall engine 
life growth plotted upon a linear scale. C-10 shows the major 
components of the engine and the asymptotic sections beyond FY 
•84 are intended to indicate that they don't expect to gain a 
gteat deal of data above the fully certificated (and realized) 
life level. It is of significance that the most crucial 
components, namely the HPFTP and the HPOTP are at the bottom of 
the totem pole, while the LPFTP and the LPOTP are not really very 
much better. Much of this is due to the actual experience over 
the four flights and the higher FPL involved. Chart C-34 shows 
the estimated data replotted from October 1980 to Octoer 1981 
resulting, in effect, in a zero gain in MTBR throughtout that 
period. In fact, the plot shows a somewhat retrograde trend but 
the dotted line reflects optimism which, in our opinion, may not 
be fuly justified. Even if the life growth rates shown in C-35 
ate realized the effect upon available SSME spares levels could 
well be serious and some launches could suffer delay. The 
following plots (Charts C-36 through C-41) indicate the same 
optimism and C-38 and C-39 for the HPFTP and the HPOTP 
respectively should be examined carefully. There appears to be 
little justification for the revised "projected improvement" 
dotted line. 

Taking the foregoing a little further and examining Chart C-52 it 
will be seen that the overhaul projections are rather awkwardly 
"bunched" especially circa 1993-1994. Rocketdyne believe that 
the natural occurrences of failures and other aberrations will 
tend to minimize some of the "bunching" and this may well prove 
to be true, but it is an uncomfortable precept with which to 
statt the program. The last Chart, C-53, summarizes the 
expressed confidence level in terms of the halved MTBR 
assumptions. The principal conclusion we drew upon the basis of 
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the data presented is that additional spare SSME’s or at least a 
larger spares float of high and low pressure oxygen and fuel 
turbopumps would provide some better insurance* 
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R ECOMMBHDATIONS (Cot the Shuttle program) 

1. The MTBR analyses, while appearing to be very thorough in 
classical reliability study terms and rendered conservative 
by the "two times factor," do not appear to be in consort 
with the spectrum of early removals being experienced in the 
program to date. A comprehensive "best case - worst case" 
analysis should be considered covering the full range of 
reasonably possible contingencies, especially in the 
logistics and supply fields, 

2 . Results to date with a wide variety of "random failure" 
induced problems on the SSME indicate that the four pumps 
are likely to have MTBR's well below original expectations - 
at least for the next year or two. The high pressue fuel 
tuibopump and the high pressure oxygen turbopump appear to 
be especially critical because of the limited spares 
available and the long lead times involved in procurement. 
Additional spare units would appear very desirable. 

3. Planned grouping of the SSME overhauls should be re-examined 
to see if they could be more uniformly distributed over the 
period 1984 through 1994. While it is most likely that 
unforeseen incidents will affect the planned dispersion and 
tend to improve it, the present layout would appear to be 
prone to loss of overhaul technical skills in the workload 
"valley" periods and thus will run counter to safety and 
reliability requirements. 

4. "Near term" support based purely upon "robbing" production 
hardware and placing reliance upon the vendors for overhaul 
and other technial service should be critically analyzed. 

The "near term" and "long term" time spans should be defined 
and very conscious steps taken toward the establishment of a 
properly based "dedicated overhaul facility," not the least 
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important of which will be the average age and experience 
level of the technicians employed. Employment stability and 
continuity is also an important factor in this respect. 

5, From the overall safety and reliability viewpoints evety 
possible effort should be made in planning to avoid 
dependence upon "cannibalizingr" or robbing from production 
lines to meet flight date requirements. Such continuing 
support pressures Inevitably run counter to safety because 
of the desire to adjust "red line," extend the life for just 
one more mission, and so on, to preserve intact the very 
expensive and highly publicly visible launch date schedules. 

RECOMMENDATIONS (for the NASA-ASAP group) 

It became clear in the course of the excellent Rocketdyne SSME 
presentation that the engine and related systems are much too 
highly specialized - and spread over too narrow a base in terms 
of the four Orbiter vehicles - to permit any other group than 
Rocketdyne to accomplish the overhaul and support tasks - or even 
for that matter, the critical pre-flight inspections. Further, 
it became more apparent at each logistics and support presentaton 
that if we, as a Panel, are to really understand the enormity of 
this task and to make valid suggestions, we have to spend much 
more time on visits and studies. Certainly the somewhat 
intangible, but never-the-less real, effects of logr^.tics and 
support philosophies upon overall system safety warrant further 
attention. 

cc: Parmet Attachment 1. Rocketdyne Organization Chart 
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APPENDIX V 

NOTES ON RELATIONSHIPS OF SHUTTLE 
PROGRAM TO COMMERCIAL AIRLINE LOGIST .TCS 


INTRODUCTION 


Now that STS-5 has been completed and with OV-099's first 
flight drawing near, some of the potential problems in 
logistics, spares and support can be viewed in somewhat 
clearer perspective. This rather rambling and discursive 
commentary represents some observations made in the light of 
extensive airline experience, both in operating and design 
fields. Some viewponts are undoubtedly contentious and 
represent only the writer's opinions and not necessarily 
those of the Aerospace Safety Advisory Panel as a whole. 

As in an airline, the relationship of overall safety to 
logistics and maintenance for a continuously operating 
Shuttle fleet is absolutely central. It is perhaps more so 
because the national prestige and multi-million dollar 
business commitments to established launch dates make it 
imperative that these will be met in a planned and orderly 
support manner, rather than by "cannibalizing” and borrowing 
from the production line. At the extreme end of this 
launch^a t-any-cost spectrum would be the unwise extension of 
major component overhaul life or the expedient adjustment of 
operating "red lines." 

At some point there must be a transition from the traditional 
NASA R&D mode to a rational operational pattern but there can 
be little comparison to that of a safe and successful 
airline. Some of the issues in these differences will be 
discussed later, but the major paradox in the Shuttle program 
appears to be that maximum utilization, amounting to a 
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projected twenty-two day turn-around (Ref.l) will occur circa 
1990 when many of the support and supply sources will have 
dried up. Even in the so-called "near term" there is an 
obvious paucity of airframe and engine spares, exacerbated by - 
the unique nature of the components and the lengthy lead 
times entailed in ordering and manufacturing them. 

THE SMALL FLEET 


The fleet size of four Orbiter (or five if OV-105 is ever 
funded) is such that, if any comparison to airline terms were 
possible, a fleet of say four B-747 aircraft would be 
considered impractical from the economic viewpoint. About 
the only way in which such an airline fleet could be made 
acceptable from the maintenance and support viewponts would 
be to become a hypothetical part of a larger carrier's fleet 
of B-747 's and to "piggy-back" on those maintenance programs. 
Obviously nothing of the sort is applicable to the Shuttle 
programand the airl ine-Shuttle comparison therefore becomes 
somewhat academic and misleading. There are, however, some 
airline control and management techniques which could 
probably be transplanted with advantage. 

Small airline fleets of large, specialized aircraaft depend 
heavily upon spares pooling arrangements, common engine and 
major component overhaul facilities, and the like. They have 
a grand common denominator with other carriers in that the 
prime manufacturer obtains, resolves and distributes 
maintenance operating data ~ especially safety related issues 
- from all sources. This is reinforced by the regulatory 
activ-ties of the PAA and thus there are probably more 
"checks and balances" than could ever be possible with the 
nature of the Shuttle program. Consequently it would appear 
that the tightest overall program management control possible 
will only be just good enough for the Shuttle in the absence 
of some of the advantages cited. 
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3. THE DETAIL DIFFERENCES IN VEHICLES 

One of the inherent problems of a fleet of vehicles which are 
almost alike is that it requires special vigilance to avoid 
the mistakes of apparent maintenance familiarity. For 
example, in the case of an actual B-7A7 fleet of the writer's 
acquaintance there are now, in seventeen aircraft no less 
than five gross, landing and zero fuel weight combinations, 
four different engine configurations (all Pratt & Whitney) , 
four different cockpit layouts and it is difficult to find 
more than two aircraft for which you could use the same 
wiring diagram manual. The moral to this story is that it is 
infinitely m e difficult to manage systems which 4re almost 
alike and this canard applies equally to the four Orbiter 
OV-099, 102, 103 and 104, 

Comprehensive individual wiring manuals are essential, rather 
than recourse to masses of blueprints to unravel the 
differences at the flight line or launch pad level. This 
will become a sine qua non around say 1990 when some of the 
continuity of the devoted cadre of experts has disappeared 
through attrition and retirement. Economies in maintenance 
publications now will reap their own negative reward later, 
but a format like the airlines' universal ATA Spec. 100 
series offers great flexibility in permitting the operators 
to do their own revisions without the requirement for off-set 
printing . 

4. THE INABILITY TO "BORROW" SPARES 


One of the interesting characteristics of large commercial 
carriers is that, while compf^ting intensively on the traffic 
route and fare structure fronts, they do, in general, 
co-operate with each other to a remarkable degree on the 
maintenance and engineering fronts. The lATP (International 
Airline Technical Parts Pool) system, initially organized 
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under lATA airline auspices, is a good example of this highly 
developed interchange system but its roots are, of course, 
in the degree of common units and parts between each of the 
carriers, including the use of each other's engines upon 
specified rental and return agreement terms. Clearly no such 
advantages are possible with the unique nature of almost 
all of the functional system components of the Orbiter and 
its supporting ground systems, but the purpose of this 
recital of the obvious is to avoid the danger of making 
logistics and spares support comparisons which are 
significantly influenced by airline techniques. 

Airline methodology has certa?lnly some lessons which could be 
of value to the Shuttle program but in this instance it is 
more likely that military techniques (shorn of some of their 
traditional overbuying excesses) would provide a better 
model. The comparatively leisurely utilization rates (in 
peacetime) would seem to provide a more accurate counterpart 
from the specific viewpoint of spares, although the length of 
the supply lines for the Shuttle involve a great deal of 
expedited special air transport methods - especially critical 
as turn-around time become shorter, 

5 . THE SLOW RATE OF MATURING (LOW UTILIZATION) 

Since the fleet base of the Orbiters is so small, and the 
rate of accumulation of hours and cycles so slow it may well 
be that the entire system will barely attain real maturity 
co-incident with obsolescence. This problem is intensified 
by the very low number of test hours compared with the 
development of a commercial airline and particularly by the 
absence of a broad "service test" phase among many different 
operators all around the world. Evan so, commercial airlines 
occasionally suffer disastrous problems at a stage when it 
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would be reasonable to assume that the entire structure and 
functional systems had reached maturity. There is also the 
reverse situation to attaining maturity in which increasing 
age has uncovered uhexpected problems necessitating major 
remedial programs especially in structural aspects. 

Maturity of the SSME will probably be Interrupted by the use 
of progressively increasing power levels necessitated by 
payload demands. Any support program should guard against 
excessive optimism in terms of anticipated and uninterrupted 
linear development of MTBR and MTBP values. The HPOTP and 
the HPFTP pumps are especially critical in view of their 
extraordinarily high performance with respect to material 
temperature limits and operating margins. The complete 
engine test stand facilities offer few alternatives in the 
event of damage due to an uncontained failure, which, it 
would seem statistically is likely to happen with the number 
of engines in the entire program through, say, the year 1990. 

THE UNEVEN PREDICTED WEAR-OUT POINTS 

The multiplicity of functional components in the Orbiter are 
at least double and probably closer to triple those in a 
large commercial transport aircraft. A large proportion of 
these are of brand new design and it is going to be extremely 
difficult to rationalize the preventive maintenance programs 
in terms of MTBR and MTBP to suit. A sophisticated aircraft 
like the Lockheed L-1011 would probably provide the best 
comparison but even so most of the functional system 
components in this case are derivatives of earlier designs 
and thus there has been a broad historical base upon which to 
predict an initial maintenance program which could be 
acceptable to the PAA's MRB - Maintenance Review Board - see 
Ref, 1) at the outset of operations. 

To achieve an. equivalent degree of confidence at the 
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commencement ot Shuttle operations is plainly not possible 
but the vital nature of this data foundation gleaning every 
piece of experience, test and early uSe information in a 
collective and systematic way for the entire system - would 
appear to be imperative especially in view of production lead 
times and batch size impoverishment. The magnitude of the 
task of producing comprehensive FMEA's (failure modes and 
effects analysis) for all critical components may result in 
an encyclopedic paper analysis which will be completed too 
late for economic supplies re-ordering. The judicious use of 
actual flight-line experience rather than somewhat abstract 
analyses should therefore be encouraged and some spares 
procurement gambles made as a form of insurance for the 
1990's. Obviously the MEA's for the selected list of 
critical high-value components must be completed first. 

7 . D ATA FEED-BACK FROM OPERATOR TO PRIME 

The mechanism of operating experience data feed-back from the 
Shuttle operations groups to the prime manufacturers warrants 
some discussion insofar as it relationship to an airline is 
concerned. In the airline case the aircraft manufacturer not 
only collects all his own data from his resident 
representative upon airframe problems but also acts as a 
"clearing house" for information on all significant vendor 
component problems. Some of the larger vendors also have 
their own representatives at the main airline base. This 
information chain is constantly endorsed by a lively defect 
reporting system produced by the airline itself and the whole 
process is enforced by the sometimes unwelcome attention of 
the FAA who have their own series of safety related 
directives and reports. 

Pareilels of some of the above do not appear to exist in the 
Shuttle program but, on the other handynsome of the liaison 
engineering procedures are probably more closely coupled. 
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especially in the R&D phase. The presence of such large 
groups of contractor personnel at KSC, for example, at evety 
launch has no parallel in commercial airline operation. In 
the airline case a small introductory team of factory experts 
is invariably stationed at the main M & E base for the first 
few months. These groups include personnel who can help 
establish the entire maintenance and overhaul programs for 
the airline operators and assist in securing FAA operating 
approval if necessary. 


Since NASA and the prime contractors appear to act as their 
own "police force" - there being no counterpart of the FAA - 
the overall perspective of data reporting requirements may 
not be as clear as in the commerical airline case. This will 
be especially true when the craft have been in operation tor 
a decade or more and are considered to be a "mature system." 
The danger of dedicated channels of information from the 
larger prime contactor contingents at Kennedy and Vandenberg 
for the rather exclusive use (even if unintentionally) of the 
principal factory always exists in a program wherein the 
manufacturer-operator relationships are manifestly 
incestuous . 


THE SPC PHILOSOPHY - STRENGTHS AND WEAKNESSES 


The Shuttle Processing Contract philosophy now being 
developed deserves some comment, particularly because, as a 
concept it has arrived rather late in the day. It Is probably 
unlikely to s^^e money as opposed to leaving the processing 
activities in the hands of knowledgeable and responsible 
prime contractors. What it can do is to try to makeup for 
some of the inherent shortcomings of such a small-fleet-base 
R&D pattern but it must consciously avoid the danger of 
internecine warfare, especially in information channels. It 
would appear that since the transfer of experience of the 
launch techniques must inevitably involve the acquisition of 
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some key petsonnel, there would perforce be some "pirating," 
at KSC in particular. Perhaps this would be necessary 
eventually in any case to permit NASA to disengage itself 
progressively from its all-absorbing Shuttle role and move on 
to other programs. 

The greatest inherent weakness in the SPC approach seems to 
revolve around the extraordinarily specialized nature of the 
Orbiter and the learning curve issues which are germane 
thereto. Equipment knowledge and overhaul repair techniques 
and facilities-- are so specialized and unique that it would 
seem to be impractical, for example, to. ever _ subcontract the 
support of the SSME's to any group other than Rocketdyne (see 
Ref. 3). There must be other Crucial systems in the Orbiter 
of the same nature, that is to say, cases in which attempts 
to transfer authority for apparent contractual advantage 
would prove unproductive. 

SUSTAINING ENGINEERING 


The somewhat euphemistic term "sustaining engineering" seems 
to embrace a combination of the function of what the airlines 
know generically as "engineering" and the manufacturer as 
"customer support" - or at least the in-service modification 
and development engineering aspects of support. The tendency 
among the larger trunk airlines today is to reduce their own 
airline engineering activities (reductions from approximately 
150 persons to 35-50 during the past three or four years 
being not uncommon) and deijend more heavily upon the 
manufacturer's support engineering services. Top airline 
management personnel are now more frequently of a legal or 
financial persuasion and the era of major influence of the 
key engineering pe, --.‘r i ty has gone (see Ref, 4). 
Consequently the likelihood of bigger airlines doing their 
o\^n corrective engineering re-design, as was the case in the 
early post WW II period has disappeared upon economic 
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grounds, and the situation may have some sort oC 
applicability to the Shuttle program. 

To the outside observer ot the Shuttle program it appeats 
that a degree of investigative engineering is being done on 
both sides of the house - NASA and the prime contractors. 

In the present R&D phase this is undoubtedly the right course 
to pursue but when NASA eventually moves into being the 
operator it would appear logical to keep the corrective 
engineering responsibility squarely with the prime 
manufacturer (if their prices aren't too impossibly high!). 
This field of "sustaining engineering" will be in need of 
careful delineation of interface relationships under the SPC 
concept to avoid duplication of responsibilities or worse, 
abdication. 

The commercial transport aircraft is in reality a very 
complex and therefore imperfect machine made practical to 
great extent by the skills of the mechanics and technicians 
who maintain them. This is iJiso true to a somewhat lesser 
extent for military aircraft, but since the design is almost 
never optimum the maintenance and operational people have to 
circumvent the shortcomings by ingenuity and adaptability - a 
process sometimes known rather grandly as "the learning 
curve." It is frequently true that there is not, and should 
not be, a solution to every problem by redesign. Indeed, the 
smaller the vehicle fleet basis the less practical it is to 
start upon a redesign in cases where operator ingenuity could 
alternatively solve the problem. In short, "sustaining 
engineering" activities should be examined and re-examined 
and where they have no effect upon safety they should be 
reviewed through the "pay-back criterion" bearing in mind 
that nine-tenths of all cost-effectiveness justif ications of 
this type are illusory in the full term. 
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SUMMARIZING COMMENT 

It one should be unwise enough to try to summarize 3uch 
admittedly unsupported impressions as the foregoing, the 
encapsulation would be something like the following. If 
nothing else some of the points might provide stimulus for 
future discussion. 

a. The Shuttle program does not appear to- have the amount 
of spares that an airline would require at a comparable 
period in the opeational development of a new fleet. 

b. It would appear that, due to the specialized and unique 
nature of the Shuttle program more, rather than less 
spares would be needed, than for an airline. 

c. The maintenance publication programs must not be 
curtailed as a cost-saving expedient - othewise we shall 
pay tor it later in continuous delays and possibly 
safety. 

d. An overall maintenance control program covering all 
aspects ot Shuttle program including the entire 
propulsion system along the lines of an PAA Maintenance 
Review Board should be prepared. 

e. The Shuttle Processing Contract concept is already late 
and it it is not to be implemented until the end of 1983 
some irrecoverable lead time will be lost. 

Aif 'Amatively, some expedient gambles on spares 
procurement should be taken by the existing channels now 
to reduce cannibalization and borrowing from the 
production line. 
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APPEHDIX VII 


Ml, Willis M. Hawkins September 13, 1982 

Senior Advisor 
Lockheed Corporation 
Burbank, CA 91520 


Ml . James M. Beggs 
Administrator NASA 
Washington, DC 20546 


Dear Jims 

During one of the past meetings you asked the Aerospace Safety 
Panel to review the safety aspects of flight operations at the 
NASA Centers. Lee Davis of the ASAP accepted the assignment 
and has now visited Langley, JSC, Ames, and DFRP. His 
recommendations are as follows: 

a. Walter Williams addressed this subject in March, His 
recommendations are sound and should be implemented, 
specifically: 

(1) Headquarters NASA should update and issue Management 
Instructions 7910,1 and 7910.2. (The ASAP would be 
happy to review drafts before official issue.) 

(2) The Intercenter Operations Group (ICOG) , consisting of 
the flight operations chiefs should be reconstituted and 
meet quarterly to exchange information on operational 
and flight safety problems. 

(3) Flight Safety should be recognized as a distinct 
discipline and experienced pilots should be assigned to 
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assist the Flight Operations Chief at each Center in 
fulfilling his safety responsibilities. 

(4) Plight Test Engineering should be a distinct and 
official function at the Research and Engineering 
Centers. Regardless of the character and duration of 
any flight program, plans and schedules should be drawn 
up, preferably by Flight Test Engineering, and approved 
by approprite levels of management. 

b. There should be greater exchange of flight safety related 
information between the operations branches of the Centers. 
This could be a function of the ICOG, (2) above. An example, 
JSC has had several flameouts (some dual) in T~38 
operations. Some weeks late DFRP which operates a T-38, 

had not heard of the problem, or its solution. 

c. Line management should be certain the^t flight safety issues 
are brought to their attention, and decisions thereon are 
not based on personalities. Example; The Flight Operations 
Chief at JSC had recommended a policy forbidding nonstop 
flights from the Cape to Ellington in T-38s. (Sound 
reasons; limited range, flameout problems, weather and 
congestion in the Houston area.) JSC management over-ruled, 
apparently influenced by the opinions of some of the 
astronauts . 

Davis feels that flight operations at the Centers are in the 
hands of competent experienced managers. It is clear that 
the functin of Flight Test Engineering with its planning and 
judgment inputs would enhance safety margins if the 
responsibility of assessing risks were assigned to such an 
organization by Flight Operations managers. Lee Davis 
specifically commends that suggestion of Williams to your 
attention. His overall attitude is that no apparent 
immediate hazards exist but inconsistencies from Base to 
Base and too-long familiarity with past practices suggest 


that new emphasis from Headquarters is imperative along with 
sincere follow-up. 


Very sincerely yours, 


Willis M. Hawkins, Chairman 
Aerospace Safety Advisory Panel 


